DSCI DCPP-01 Exam - Topic 2 Question 81 Discussion

Data Controller An organization that determines means and purpose for data processing is called a Data Controller. It may or may not be the organization that directly collects PI from a data subject but, is accountable for PI usage, security, etc. All organizations are Data Controllers by default for their employees' PI. Data Processor An organization that processes PI based on instructions of Data Controllers. In some instances, it may also be the organization that collect PI directly from the individuals, on behalf of Data Controller. A BPM organization processing personal information on behalf of clients would be a data processor. Similarly, a sales agent for a bank would also come under this category.